Require VPN to log in
Extra security measure – Add a feature where only people from a specific country is allowed to log in.
The trick is to use another country than the one you live in. So if you live in the US, only allow users to log in from New Zealand.
This of course requires a VPN for the admin to be functional, but would be an additional deterrent. All other login protections will still be in place.